5.4 Viewing Files and Following Logs

By Ravindra Bagale Last updated: 27 September 2026

Command	Use
`cat file`	Print entire file
`less file`	Scroll page by page (`Space` next, `b` back, `/word` search, `q` quit)
`more file`	Older, simpler pager
`head -n 20 file`	First 20 lines
`tail -n 20 file`	Last 20 lines
`tail -f /var/log/nginx/access.log`	Follow a log live (Ctrl+C to stop)
`wc -l file`	Count lines (`-w` words, `-c` bytes)
`diff a b`	Show differences between two files

cat /etc/os-release          # which Linux distribution and version?
head -5 /etc/passwd
sudo tail -f /var/log/messages      # Amazon Linux / CentOS system log
sudo tail -f /var/log/syslog        # Ubuntu system log

Why this matters for security

tail -f on an auth or web log is the simplest real-time monitoring there is. While you practise brute force in Part 10, keep sudo tail -f /var/log/auth.log (Ubuntu) or sudo journalctl -u sshd -f (Amazon Linux 2023) open on the target – you will see the attack exactly as a SOC analyst sees it.

Ravindra Bagale's Tip

When you cat a large log file, the screen fills up and many students panic. Always open a large file with less or tail -n 50. Use cat only for small files.

Ravindra Bagale's Tip – मराठी

मोठी log file cat केली की screen भरून जाते आणि बरेच students घाबरतात. मोठी file नेहमी less किंवा tail -n 50 ने उघडा. cat फक्त छोट्या files साठी.

Ravindra Bagale's Tip – हिंदी

बड़ी log file को cat करते ही screen भर जाती है और बहुत से students घबरा जाते हैं. बड़ी file हमेशा less या tail -n 50 से खोलो. cat सिर्फ़ छोटी files के लिए.

Practice task

Show the first 5 and last 5 lines of /etc/passwd, count its lines with wc -l, and follow the system log live for one minute.